SnapNSign← App

Privacy Policy

Last updated: 16 October 2026

This Privacy Policy explains how SnapNSign (“we”, “us”), operated by BETA-B (the data controller), handles information when you use the SnapNSign web app at snapnsign.com (the “Service”). Contact: support@snapnsign.com.

1. Our approach in short

  • Documents are encrypted end-to-end in your browser (AES-GCM-256) before they leave your device. The decryption key is part of the share link after the “#” sign and is never sent to our servers.
  • For an ordinary signing link, our server only relays the encrypted file between sender and signer. It is deleted as soon as the sender downloads the signed copy, and in any case no later than 48 hours after upload. For a group link, the common encrypted original is available for up to 10 days; each encrypted signed result is available for no more than 48 hours and is deleted as soon as the sender receives it.
  • Readable documents and decryption keys are stored on your device. If you choose encrypted Google Drive backup, the app encrypts each item in your browser before saving ciphertext in a visible “SnapNSign encrypted backup” folder in your own Google Drive. SnapNSign and Google do not receive your recovery code and cannot read the backup. A verified email account is required to complete documents. The SnapNSign account never stores readable documents or decryption keys.

2. Information we process

  • Encrypted documents. Ciphertext uploaded by the sender and by the signer. We cannot read it.
  • Current relay technical metadata. Random document, campaign and claim IDs; cryptographic hashes of capability tokens; creation and expiry times; technical status; page count; and file size. Group campaign records do not contain signer names or email addresses.
  • Planned operation evidence journal. Once the required integration is ready, we plan to retain minimal metadata for each completed operation for 7 calendar years, an operator policy rather than a universal legal requirement. Purposes are to evidence the operation and the version shown, address disputes, and protect service security. The planned fields are random operation and participant IDs, server timestamp, client-declared plaintext SHA hashes, page count and signature-placement geometry, exact immutable legal and consent version/language/hash, outcome and authentication method. Because of end-to-end encryption, the server cannot independently verify declared hashes against plaintext. The journal will not contain raw PDFs, signature images, encryption keys, email addresses, IP addresses or document titles. Pseudonymous metadata can still be personal data where a person can be identified. This is a planned policy, not a statement that the journal or its controls are already operating.
  • Account data. Your email address, account creation and last sign-in time, starter/monthly/purchased credit balances, subscription plan/status/billing-period end, purchase dates, expiry dates and remaining purchased-credit lots, and a credit history (purchases and spends with the amount, page count, a random document ID and time — never document content, names or file names).
  • Email preferences. If you actively select the optional marketing checkbox, we store the time and source of that consent. If you switch it off, we store the opt-out time so the choice is respected. Creating an account or signing a document does not by itself opt you into marketing. When a one-time opt-in bonus is offered and granted, we also store the grant record (time, the consent path that triggered it, the promotional credit lot and whether it was later withdrawn) so the bonus is given only once per account; the IP-based rate limit used to prevent abuse of the bonus is kept as a short-lived counter (see “Retention”).
  • Sign-in codes and sessions. One-time sign-in codes are stored only as a keyed hash, expire after 10 minutes and are deleted after 5 wrong attempts. Your session is kept in a strictly necessary, HttpOnly, secure cookie (sns_session); on the server only a hash of the session token is stored.
  • Abuse protection. To prevent abuse of sign-in and uploads we keep short-lived counters keyed by IP address and by email address (rate limits), and we use Cloudflare Turnstile on the sign-in form, which may process device and browser signals to tell humans from bots.
  • Connection data. Like any website, our hosting provider processes IP addresses and request data (e.g. browser type) to deliver the Service and protect it from abuse. These logs are short-lived.
  • Group link notification emails. If you created a group signing link, we may email you about new signed copies (immediately or as one daily summary, as you choose per link, daily summary by default) and once shortly before the link stops accepting signatures. These emails contain only counts, dates and a link to open the app — never documents, document names, signer names, email addresses or decryption keys. To send them we keep a small queue and a delivery log (random campaign and result IDs, the chosen frequency, number of attempts, the provider’s message ID and the last error) for up to 90 days. Every such email has an unsubscribe link and a standard List-Unsubscribe header; you can also turn them off per link or for your whole account in the app. We cannot email participants who have not signed, because a group link carries no recipient list.
  • Optional Google Drive connection. If you connect Google Drive, Google gives SnapNSign OAuth credentials limited to files created or explicitly opened with the app (drive.file). SnapNSign uses its own encrypted-backup files. Refresh and short-lived access tokens are encrypted before storage in our account database. Our server passes through only opaque, browser-encrypted vault objects and cannot decrypt them. File names are opaque hashed identifiers and do not contain your document names; Google can see the folder name, file sizes and timestamps. You can disconnect at any time; disconnecting deletes the Google credentials we store and asks Google to revoke our access, but does not automatically delete encrypted objects already in your Google Drive. Your separate recovery code is generated and kept on your device and is never sent to SnapNSign.
  • Analytics and usage. If you accept optional cookies, we use Google Analytics 4 (Google LLC) and Microsoft Clarity (Microsoft Corporation) to understand how the Service is used, which pages and features are used, and where the product can be improved. Google Analytics sets cookies and/or uses device and browser identifiers to measure visits, sessions and events. Microsoft Clarity records heatmaps and session replays (mouse/touch movements, scrolls and clicks) and may set cookies or use similar device identifiers for that purpose. Clarity’s session recordings do not include the contents of password fields; we ask you not to type document contents into free-text fields outside the encrypted document flow. These tools may process your IP address, device and browser information, and pages you visit on snapnsign.com. Data may be processed in the United States and other countries. Your choice is stored in your browser as sns_consent_v1; rejecting optional cookies leaves these tools disabled. Google also offers an opt-out browser add-on. We may additionally use Cloudflare Web Analytics (cookieless, aggregated). Analytics, Clarity and the Meta Pixel are never loaded on individual signing links (/s/…), group signing links (/b/…) or phone-scanning links (/c/…), because those links contain encryption keys. On a device where encrypted Google Drive backup is set up, they are not loaded at all, even if you accepted optional cookies, so that no third-party script runs next to your backup key (this choice is remembered as sns_vault_device_v1 in local storage).
  • Advertising measurement (Meta Pixel). If you accept optional cookies, we use the Meta Pixel (Meta Platforms, Inc.) to measure the effectiveness of our ads on Meta platforms (for example Facebook and Instagram), to understand which visits and purchases came from those ads, and to improve how we run advertising. The Pixel sets cookies and/or uses device and browser identifiers for ads measurement. It may process your IP address, device and browser information, pages you visit on snapnsign.com, and conversion events such as viewing pricing and completing a purchase (amount and currency, without payment card details). We do not send your email address, name, phone number, or document contents to Meta through the Pixel. Data may be processed in the United States and other countries. Rejecting optional cookies leaves the Pixel disabled. Meta also provides ads preferences in your Meta account.

3. Information inside documents

When a document is signed, the signer’s drawn signature, the optional name they type, the signing time, the browser’s user-agent string and cryptographic hashes are embedded into the PDF and an audit page. This information is part of the encrypted document and is accessible to holders of its decryption key, normally the sender and the signer, and anyone with whom they share the document or its complete link and key. It is not readable by us.

Group signing. The sender may create one common link from which each participant makes an independent signed copy. The common original and every result are encrypted in the browser with keys that never reach us. The server stores only ciphertext and random technical IDs; a participant's verified account is used to authorise completion but their email is not copied into the campaign record. Results downloaded by the sender are saved in that sender's browser and removed from the relay.

Scanning with a phone. On a computer you can choose “Scan with phone”: the computer shows a QR code, and the photos you take on your phone are sent to that computer. Each photo is encrypted on the phone with a key that exists only in the QR link, so we cannot see it. The encrypted photo is kept on our server (Cloudflare R2) only until the computer picks it up — at most 15 minutes — and is then deleted; leftovers of expired or closed codes are removed automatically within the next hour. The phone page needs no account, does not load analytics, and is not listed for search engines. To slow down abuse we count requests per network address using a short hash of the address, not the address itself.

4. Data stored on your device

The app stores documents, encryption keys, the list of sent and signed documents, your credit balance (or a cached copy of your account balance), language and app-lock settings in your browser’s storage (IndexedDB / localStorage). You can delete it at any time by removing documents in the app or clearing the site data in your browser. We cannot access or recover this data. If you enable Google Drive backup, encrypted copies of your documents, templates, reusable signature and stamp are also stored in your own Google Drive encrypted-backup folder; only a browser holding your recovery code can decrypt them.

5. Purposes and legal bases

We process account, payment and relay information to provide the Service you request. Where objectively necessary, we rely on performance of a contract; where applicable, we may rely on legitimate interests such as service security, fraud prevention and handling disputes, subject to your rights and applicable law. A legal obligation may apply to particular records. We do not treat all processing as based on consent, and the applicable basis depends on the processing and circumstances. Optional analytics, advertising measurement (Meta Pixel) and marketing emails rely on your consent where required, which you can withdraw at any time without affecting the Service. The planned operation evidence journal described above is intended to support evidence, dispute handling and security; its basis will be assessed for the relevant processing and applicable law before activation.

Marketing emails and how to withdraw. We send marketing emails (occasional tips, offers and bonus-credit promotions) only if you actively ticked the optional checkbox at sign-in or in your account. You can withdraw that consent at any time by switching the checkbox off under Account → Email preferences, by using the unsubscribe link in any marketing email, or by writing to support@snapnsign.com; service and security messages (sign-in codes, credit-expiry reminders, receipts) are sent regardless because they are needed to provide the Service. Withdrawing consent stops future marketing emails; it does not remove a promotional bonus you already received, and does not affect purchased credits.

6. Service providers

We use Cloudflare, Inc. for hosting, content delivery, storage of encrypted relay files and account data (Cloudflare D1 database), security and bot protection (Turnstile). If you explicitly connect encrypted backup, Google LLC stores the opaque ciphertext in your own Google Drive encrypted-backup folder and supplies the OAuth connection described above. We also use Google LLC (Google Analytics) and Microsoft Corporation (Microsoft Clarity) for optional product analytics, and Meta Platforms, Inc. (Meta Pixel) for optional advertising measurement, as described in section 2. Sign-in codes, service emails and — only after opt-in — occasional marketing emails are delivered through Resend (Plus Five Five, Inc.), which receives your email address and the message. Marketing messages must include an unsubscribe method, and switching marketing off in the account prevents future campaigns. Payments are processed by Paddle.com as merchant of record: Paddle receives your email address and an internal account ID, handles payment details, and sends us transaction, subscription, plan, amount/currency, refund and chargeback events. We do not receive your full payment-card details. To show regional prices we use the country determined by Cloudflare from your IP address; it is not stored. We do not sell personal information.

7. Retention

  • Ordinary signing links: encrypted files and metadata are deleted after the sender receives the signed copy, otherwise automatically after 48 hours.
  • Group signing links: the common encrypted original and pseudonymous campaign metadata are deleted when the sender closes the campaign or after 10 days. Each encrypted signed result is deleted immediately after the sender confirms receipt, otherwise after no more than 48 hours.
  • “Scan with phone” photos (encrypted): deleted as soon as the computer picks them up, and at the latest within about an hour after the 15-minute code expires.
  • Planned operation evidence journal: if activated after integration readiness, metadata is retained for 7 calendar years under the operator's policy, not because that duration is a universal legal requirement. Deletion will follow expiry unless a narrow, documented legal hold applies; only the data needed for that hold will be retained until release.
  • Account data (email, credits, credit history and email preferences): until you delete your account or request deletion. A planned journal entry will not automatically be erased by account deletion where a lawful, justified retention requirement or basis applies; this does not extend the separate account-data retention period.
  • Google Drive OAuth credentials: until you disconnect Google Drive or delete your account. Encrypted vault objects in your own Drive remain until you delete the “SnapNSign encrypted backup” folder in Google Drive.
  • Sessions expire after 45 days; used or expired sign-in codes and rate-limit counters are deleted automatically within a day.
  • Records of purchases may be kept longer where tax or accounting law requires it.
  • Group notification queue and delivery log: up to 90 days.
  • Server logs: kept only as long as needed for security and operations.
  • On-device data: until you delete it.

8. International transfers

Our providers may process data in countries other than yours. Where required, transfers are protected by appropriate safeguards such as Standard Contractual Clauses.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete or restrict the processing of your personal data, to object, and to data portability, as well as the right to lodge a complaint with a supervisory authority. We cannot decrypt documents; on-device documents can be managed directly on your device, encrypted Drive objects can be managed through your Google account, and account data can be viewed or deleted in the app. For any request, contact support@snapnsign.com.

10. Children

The Service is intended only for users who meet the eligibility requirement in our Terms (at least 18 years old or the age of majority in their country).

11. Changes

We may update this policy. We will change the “Last updated” date and, for significant changes, notify users in the app. Historical accepted versions are not retroactively replaced; the exact published text is identified by its version, language and hash.

12. Contact

BETA-B (operator of SnapNSign), support@snapnsign.com